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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978, This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report addresses the strengths and weaknesses of the Federal Emergency 
Management Agency's efforts to prevent fraud. It is based on interviews with employees 
and officials of relevant agency units, direct observations, and a review of applicable 
documents. 

The recommendations herein have been developed to the best knowledge available to our 
office, and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




TMrles K. Edwards 
Acting Inspector General 
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Executive Summary 

This report provides our assessment of the Federal Emergency 
Management Agency's fraud prevention efforts. Through its 
Individuals and Households Program, FEMA quickly disburses 
billions of dollars to disaster survivors. The program's 
susceptibility to fraud, waste, and abuse requires increased vigilance 
in order for the agency to be a better steward of taxpayer money. 

The Federal Emergency Management Agency's Fraud Prevention 
and Investigation Branch assists in identifying and reporting 
potential fraud in agency programs. However, more can be 
accomplished with an agency-wide mandate, a reallocation of 
resources and staff, and access to the latest fraud prevention tools. 

The agency strives to provide assistance to disaster survivors 
quickly, but also needs to ensure that assistance is provided only to 
eligible recipients and for the proper amount. Agency leaders must 
take visible, substantive, and continual steps to demonstrate the 
importance of fiscal responsibility and program integrity. 
Increasing the visibility of the Fraud Branch and mandating fraud 
prevention training for all employees will help the agency increase 
attention to fraud prevention and deterrence. 

The agency has improved its internal controls since hurricanes 
Katrina and Rita. However, the Office of Inspector General and 
Government Accountability Office reviews, as well as agency 
assessments, continue to identify needed improvements in internal 
controls in assistance programs. Implementation of these controls 
will deter fraud and reduce the risk of issuing improper payments. 

Approximately $643 million in potential improper Individuals and 
Households Program payments have been identified since 
Hurricane Katrina. Recently, the agency restarted a recoupment 
process that had been halted since 2007. The recoupment process 
should continue until all cases are resolved. 

This report contains eight recommendations that, when 
implemented, will improve fraud prevention efforts. 
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Background 



In responding to natural or manmade emergencies, current policy 
provides that the government agencies and organizations most 
local to the situation act as first responders. When state and local 
governments become overwhelmed by the size or scope of a 
disaster, state officials may request assistance from the federal 
government, so federal agencies must always be prepared to 
provide support when needed. In 1979, President Carter issued an 
Executive Order that created the Federal Emergency Management 
Agency (FEMA) and merged many of the federal government's 
separate disaster-related functions. Following the terrorist attacks 
of September 11, 2001, the Homeland Security Act of 2002 
(Public Law [P.L.] 107-296) realigned FEMA and made it part of 
the newly formed Department of Homeland Security (DHS). 

FEMA's statutory authority to provide disaster assistance comes 
from the Robert T. Stafford Disaster Relief and Emergency 
Assistance Act, as amended (P.L. 100-707) (Stafford Act), which 
was signed into law in 1988 and amended the Disaster Relief Act 
of 1974 (P.L. 93-288). To access federal assistance under the 
Stafford Act, generally, states must make an emergency or major 
disaster declaration request that FEMA reviews for presidential 
approval. Section 408 of the Stafford Act permits the President to 
provide financial assistance and, if necessary, direct services, to 
individuals and households in the state who, as the direct result of 
a major disaster, are unable to meet necessary expenses and 
serious needs through other means. 1 Figure 1 shows the 
devastation brought on by the North Dakota flooding in 2009. 



Figure 1. North Dakota Flooding, 2009 




Source: FEMA Photo Library; photographer, Patsy Lynch. 

1 Section 408, Federal Assistance to Individuals and Households (42 U.S.C. 5174). 
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Immediately after the President declares a disaster, affected 
individuals may apply for assistance from the Individuals and 
Households Program (IHP) in person, by calling a toll-free 
telephone number, or through the Internet. Registrants provide 
FEMA with a variety of information, including name, Social 
Security number, address and telephone number of the damaged 
properly, current address and telephone number, insurance 
information, and a description of losses incurred. IHP assistance 
may include temporary housing (rent and lodging expenses) and 
home repair or replacement. 

FEMA administers IHP disaster assistance through the National 
Emergency Management Information System (NEMIS), and uses 
a contractor to validate identity, occupancy, ownership, and other 
information provided by registrants during the registration 
process. The contractor validates this information by comparing 
the registrant's name with the Social Security number, address, 
and other information provided. In addition, FEMA uses edit 
checks in NEMIS to identify duplicate registrations and to prevent 
duplicate payments to registrants who have provided invalid or 
fraudulent information when registering for assistance. 

As part of the registration process, a FEMA contractor performs a 
physical inspection of the residence. The inspector: 

• Meets with a registrant and reviews documentation to 
validate the registrant's identity, occupancy of the 
damaged address, and if applicable, the registrant's 
ownership of the damaged address; 

• Inspects the address to determine what physical damage 
was sustained during the disaster; 

• Records the validation of a registrant's documentation and 
the damage caused by the disaster on a FEMA-provided 
computer; and 

• Uploads this information to NEMIS. 

Once these tasks are completed, FEMA determines the type and 
amount of assistance for which the registrant is eligible. 

In 2004, Florida was hit by four hurricanes, and FEMA disbursed 
nearly $209 million in IHP assistance. Concerned with an 
increase in fraudulent claims for assistance, a DHS Office of 
Inspector General (OIG) proposal resulted in the establishment by 
the director of the Florida Long-Term Recovery Office (FLTRO) 
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of a fraud prevention unit. (A recent FEMA reorganization 
placed the unit under the Fraud and Internal Investigation 
Division in the Office of the Chief Security Officer (OCSO) in 
FEMA headquarters and renamed the unit the Fraud Prevention 
and Investigation Branch (FPIB).) FPIB's mission includes 
identifying, mitigating, and preventing fraudulent losses of federal 
funds and assets through agency fraud awareness training and 
recoupment of losses in partnership with the DHS OIG. (It is 
important to note that although FPIB has "Investigations" in its 
name, it does not conduct criminal investigations.) 

One of FPIB's responsibilities is to identify best practices to 
prevent and deter fraud, waste, and abuse in FEMA's delivery of 
disaster assistance. Agencies such as FEMA seek ways to better 
achieve their missions and program results; a key factor in 
achieving such outcomes is implementing appropriate internal 
controls. Figure 2 illustrates the objectives of internal control. 

Figure 2. Internal Control Objectives 



Internal Control 

An integral component of an organization's management that 
provides reasonable assurance that the following objectives are 
achieved: 

• Effectiveness and efficiency of operations; 

• Reliability of financial reporting; and 

• Compliance with applicable laws and regulations. 



Source: Government Accountability Office (GAO). 

Internal controls are the plans, methods, and procedures that an 
agency uses to meet missions, goals, and objectives that support 
performance-based management and serve as the first line of 
defense in safeguarding assets and preventing and detecting errors 
and fraud. 3 Figure 3 illustrates the important role of internal 
controls in fraud prevention. 



2 Instruction Number 1251, Operations of the Florida Long-Term Recovery Office Fraud Prevention and 
Investigation Unit, Florida Long-Term Recovery Office, November 16, 2007. 

3 Standards for Internal Control in the Federal Government (G AO/ AIMD-00-2 1.3.1), November 1999. 
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Figure 3. Using Internal Controls to Prevent Fraud 




Source: GAO. 



Results of Review 

FEMA has identified and reported potential fraud to OIG, but more can be done 
with additional staffing and analytical tools, and by providing FPIB with agency- 
wide authority to change program processes and procedures. FEMA has made 
progress in preventing fraudulent losses of federal funds, but challenges remain 
in developing, establishing, and enhancing proper internal controls and 
recouping improper disaster assistance payments. 

Identifying and Reporting Potential Fraud 

FPIB was created to assist in identifying and reviewing potentially 
fraudulent and otherwise improper disaster assistance payments. Although 
FPIB has identified and reported potential fraud to OIG, its impact has 
been limited because of the branch's insufficient authority and resources. 

Potential Fraud Identified and Reported to OIG 

FPIB has identified and reported to OIG potential fraud in 
FEMA's individual assistance programs, including IHP (see 
Figure 4). It has also reported cases of potential fraud in FEMA's 
Public Assistance and Mitigation programs. 
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Figure 4. FPIB Activities From FY 2007 Through FY 2010 
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Source: OIG analysis of FEMA data. 

FPIB conducts data analysis to examine information contained in 
disaster assistance applications to identify and prevent losses of 
federal disaster funds. FPIB reports evidence of fraudulent 
FEMA assistance claims to DHS OIG for investigation. Based on 
lessons learned from its review of disaster assistance applications 
and data analysis, FPIB has made suggestions to lessen fraud, 
waste, and abuse. Appendix C depicts FPIB's case flowchart. 



FPIB assesses and validates allegations and claims referred from 
the Office of Investigations of DHS OIG (INV), developed in- 
house, or received from external parties. From January 2010 to 
February 201 1, INV referred 292 FEMA fraud complaints to 
FPIB, 141 (48%) of which contained evidence of fraud, which 
INV opened for investigation. 



FPIB Resources and Authority 



FPIB's impact on fraud prevention activities in FEMA is limited 
by inadequate resources and insufficient authority over program 
staff and processes. In FY 2010, FPIB's budget for salaries 
totaled $537,000. Figure 5 reflects FPIB's declining budget. 
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Source: FEMA. 

In FY 2010, FPIB was authorized nine full-time equivalents 
(FTEs), but only six are on board. 4 Figure 6 shows how the 
staffing level has declined over the past 3 years. This is an 
additional indication of FEMA' s need to improve its commitment 
to fraud prevention and awareness efforts. 



Fig 



ure 6. Fraud Prevention and Investigation Branch FTEs 




Source: FEMA. 



With greater resources, FPIB will be able to review more of the 
hundreds of thousands of applications for assistance that FEMA 
services annually in its Individual Assistance, Public Assistance, 
and Mitigation programs, including the National Flood Insurance 
Program. 



4 The current FPIB employees are FTE Cadre of On-Call Reserve Employees (CORE). CORE positions 
are temporary, excepted service appointments with specific "Not to Exceed" dates. The appointments are 
2- and 4-year terms and are typically renewed if there is ongoing disaster work and funding is available. 
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As important as the need for additional resources is the need to 
establish FPIB as a FEMA-wide organization with authority to 
require changes in program processes and procedures across 
FEMA. Instruction Number 1251 established FPIB to focus its 
attention on activities in Florida. FPIB review activities are 
limited to — 

• Complaints and reports of reviews referred to FLTRO 
from the OIG; 

• Complaints of fraud, waste, and abuse sent directly to 
FLTRO; and 

• Fraud, waste, and abuse uncovered by FPIB and FLTRO 
employees during FLTRO operations. 

A FEMA management directive should be issued establishing FPIB 
as a FEMA-wide entity with authority to review all FEMA- funded 
programs nationwide and recommend improvements to internal 
controls to deter and prevent fraud, waste, and abuse. FPIB's 
scarce resources also limit its ability to obtain and use the latest 
fraud prevention tools and sources to identify and report potential 
fraud. 

The Recovery Accountability and Transparency Board 

The Recovery Accountability and Transparency Board (RAT 
Board) was established in 2009 to ensure transparency in the 
expenditure of American Recovery and Reinvestment Act of 2009 
(Recovery Act) 5 funds. To minimize fraud, waste, and abuse in 
Recovery Act activities, the board established the Recovery 
Operations Center, which uses numerous data sources and cutting- 
edge technology to ensure proper accountability and transparency 
in the expenditure of government funds. Contracts with third 
parties provide the center with access to millions of public records 
that are updated daily, as well as law enforcement databases. 

In June 2010, Vice President Biden announced the RAT Board's 
expansion of a cutting-edge fraud-mapping tool that gathers large 
quantities of information in real time, analyzes the data, and helps 
"connect the dots" to identify indicators of possible fraud or error. 
FPIB should adopt the precedent-setting measures used by the 
RAT Board, such as the fraud-mapping tool, to foster 
accountability and transparency of FEMA programs and improve 
internal controls. 



5 P.L. 111-5. 
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In November 2010, FEMA's Disaster Operations & IT Section 
posted a Request for Information as part of market research for a 
"systematic solution to strengthen controls for prevention of 
improper payments as a result of fraud, waste, and abuse in 
government financial and other forms of assistance programs." 
We hope that FEMA is able to acquire this type of advanced 
technological tool to assist the assistance programs and FPIB. 

Conclusion 

The Fraud Prevention and Investigation Branch has identified and 
reported to OIG potential fraud in FEMA's Individual Assistance, 
Public Assistance, and Mitigation programs. However, its 
activities have been hampered by insufficient resources, limited 
authority over FEMA program offices and staff, and the 
unavailability of the latest technology to detect and deter fraud. 



Recommendations 

We recommend that the Administrator, Federal Emergency 
Management Agency: 

Recommendation #1 : Reallocate resources to increase the staff 
and budget of the Fraud Prevention and Investigation Branch. 

Recommendation #2 : Issue a Federal Emergency Management 
Agency Directive that establishes the Fraud Prevention and 
Investigation Branch as the agency-wide office with the authority 
to: (1) review all claims of potential fraud, waste, and abuse for 
fact-finding and referral to appropriate entities for action; 

(2) proactively review disaster assistance payments; and 

(3) recommend improvements to internal controls. 

Recommendation #3 : Adopt cutting-edge technology similar to 
that used by the Recovery Accountability and Transparency 
Board. 

Management Comments and OIG Analysis 

FEMA provided written comments. Below is a summary of the 
agency's responses to our recommendations and our analysis of 
those responses. After a review of FEMA's response, we agreed 
to withdraw what was labeled Recommendation #7 in our draft 
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report, which dealt with FEMA's information technology 
systems. We note in the conclusion of our recently released 
report, Federal Emergency Management Agency Faces 
Challenges in Modernizing Information Technology (OIG- 11-69), 
that the agency's existing information technology (IT) systems do 
not support disaster assistance response activities effectively. A 
copy of the agency's response to the draft recommendations is 
included in Appendix B. 

FEMA concurs with Recommendation #1 and states that, as a 
result of a review of FPIB staffing levels, it plans to increase the 
CORE staffing levels by 50% in FY 201 1 and another 50% in FY 
2012. We consider this recommendation resolved and open. At 
the close of FYs 201 1 and 2012, we will verify the FPIB staffing 
levels. 

FEMA concurs with Recommendation #2, but we are concerned 
with the specifics of its concurrence. FEMA states that the Office 
of the Chief Security Office will draft an agency-wide directive 
on FPIB and its responsibilities. However, we would like 
assurance that this directive will be signed by the Administrator 
and provide FPIB with the authority to: (1) review all claims of 
potential fraud, waste, and abuse; and (2) require changes in 
program processes and procedures across FEMA. The directive 
should reference the FPIB/INV collaboration, which can then be 
formalized in a cooperative agreement between the parties. We 
consider this recommendation unresolved and open until the 
necessary directive is issued. 

We also take this opportunity to respond to a portion of the second 
paragraph of FEMA's comment letter (Appendix B). FEMA 
implies that the objectivity of this report is in question because 
FPIB has a "close, direct working relationship" with OIG. The 
opinions, conclusions, judgments, and recommendations in this 
report are impartial and solely based on the information gathered 
during this review. The audit organization and individual auditors 
were independent. They exercised professional judgment in the 
performance of their work and preparation of this report, as 
required by government auditing standards. 

FEMA concurs with Recommendation #3, but says that it needs to 
do a more detailed review of the RAT Board technology before a 
final position on the recommendation can be reached. FEMA 
states that it has already deployed a new IT system for FPIB that 
is designed to, among other things: (1) integrate with the agency 
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IT systems, and using internal and external data, conduct data 
mining; (2) provide a risk-mapping tool to identify risk; and (3) 
serve as a case management system for collecting and tracking 
investigative activities and analysis involving disaster fraud. 

We are not recommending that FEMA adopt the exact technology 
used by the RAT Board, but rather that FEMA adopt technology 
that uses the latest tools for detecting and deterring fraud. We are 
unclear as to what new IT system FEMA refers. FEMA has a 
pilot program using VANTOS, which was described to us as a 
case management system. Although VANTOS has some data- 
gathering capability, it appears to emphasize record-keeping and 
reporting. 

Additionally, FEMA issued a Request for Information in late 2010 
as part of market research for a systematic solution to strengthen 
internal controls for prevention of improper payments as a result of 
fraud, waste, and abuse. This market research appears to be the 
first step in acquiring technology capable of conducting data 
mining, risk mapping, and other fraud prevention activities. We 
consider this recommendation unresolved and open. 

Fraud Prevention Awareness 

FEMA's disaster assistance programs are susceptible to fraud, waste, and 
abuse. The agency culture promotes prompt assistance to disaster 
survivors, without an equal emphasis on financial responsibility. To 
emphasize the importance of fraud prevention in FEMA's mission, the 
Fraud Branch should report directly to the Office of the Administrator, 
and all employees should receive annual fraud prevention training. 

FEMA's Programs Susceptible to Fraud, Waste, and Abuse 

Despite a history of abuse in its disaster assistance programs, 
FEMA has not established an environment in which employees 
understand fraud prevention to be an integral part of the agency's 
mission. 

The Federal Managers ' Financial Integrity Act of 1982 requires 
that each executive agency establish internal accounting and 
administrative controls that safeguard funds against waste, loss, 
unauthorized use, or misappropriation. 6 Office of Management 
and Budget (OMB) Circular A- 123 states, "Management has a 



6 P.L. 97-255 (codified as amended at 31 U.S.C. §3512). 
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fundamental responsibility to develop and maintain effective 
internal control. The proper stewardship of Federal resources is an 
essential responsibility of agency managers and staff. ... Programs 
must operate and resources must be used consistent with agency 
missions, in compliance with laws and regulations, and with 
minimal potential for waste, fraud, and mismanagement." 7 

Despite these requirements, FEMA's programs remain susceptible 
to waste, fraud, and abuse. The GAO testified in June 2006 that 
as of February 2006, about 16% of FEMA payments to applicants 
for individual assistance following hurricanes Katrina and Rita 
were improper and potentially fraudulent. 8 DHS' in-house 
analysis reported an estimated improper payment rate of 8.56% 
through March 1, 2006, and could not explain the discrepancy 
between its and GAO's assessments. 9 In December 2006, GAO 
testified that "FEMA continued to lose tens of millions of dollars 
through potentially improper and/or fraudulent payments" and 
that "FEMA's difficulties in identifying and collecting improper 
payments further emphasized the importance of implementing an 
effective fraud, waste, and abuse prevention system." 10 DHS and 
FEMA stated in the DHS Annual Financial Report for FY 2008 
that the IHP was known to be at "high risk" for improper 
payments. 

Improper payments did not begin with catastrophic storms that 
struck the Gulf Coast in 2005. The U.S. Senate Committee on 
Homeland Security and Governmental Affairs (Senate 
Committee) uncovered payments for fraudulent claims, wasteful 
spending, and ineffective management and internal controls 
following the four hurricanes that struck Florida in 2004. 11 

FEMA staff said that individual assistance is a complicated 
program, made more difficult by pressures imposed by politics 
and senior officials. Business rules are set for each disaster, and 
fraud is minimized when these rules and normal procedures are 
followed. However, staff told us that after disasters strike, they 
often receive instructions from senior management to change the 



7 OMB Circular A- 123, Management's Responsibility for Internal Controls, I. Introduction. 

8 Hurricanes Katrina and Rita Disaster Relief: Improper and Potentially Fraudulent Individual assistance 
Payments Estimated to Be Between $600 Million and $1.4 Billion (GAO-06-844T), June 2006. 

9 DHS Performance and Accountability Report, FY 2006. 

10 Hurricanes Katrina and Rita Disaster Relief: Continued Findings of Fraud, Waste, and Abuse (GAO- 
07-252T), December 2006. 

11 Hurricane Katrina: A Nation Still Unprepared, Special Report of the Committee on Homeland Security 
and Governmental Affairs, United States Senate, S. Rept. 109-322, 2006. 
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agreed-upon rules for the event or establish new procedures, 
resulting in employee mistakes and an increased risk of fraud. 

Improper payments result from fraud, human error (e.g., data 
entry errors by FEMA employees), mistake (e.g., recipient is 
ineligible because of insurance, or the damaged home is not the 
recipient's primary residence), and inadequate internal controls 
(e.g., recipient's ownership of home is not verified). 

Agency Culture Promotes Assistance 

We interviewed more than 20 mid-level and senior managers at 
FEMA. They uniformly described the "FEMA culture" as one in 
which the mission was to get assistance to people as quickly as 
possible. Staffers told us: 

• "The focus is to get money out to people who need it;" 

• 'The culture is to tout how many dollars have been given 
out;" 

• 'The FEMA attitude is to simply pay the people;" 

• "The FEMA philosophy is to accept and encourage all 
applicants;" and 

• "FEMA begs people to call and apply, even if they are not 
sure they are eligible." 

Employees involved in the individual assistance programs have 
not been instructed to be alert to fraud. One employee who 
assisted applicants for assistance sometimes made telephone calls 
to verify suspicious information provided by applicants. Her 
supervisor told her to stop looking for fraud. Other interviewees 
confirmed that it was not the caseworker's job to look for fraud 
when reviewing information provided by applicants. 

Some senior officials assert that FEMA cannot quickly assist 
disasters survivors and be fiscally responsible. The Senate 
Committee quotes Michael Brown, then the Director of FEMA, 
saying in 2005, "Among the many challenges we face when 
responding to disasters, the most difficult often involves 
balancing the tradeoff between ensuring a timely and effective 
response to those in need, and the responsibility to protect the 
fiscal responsibility of the program. It is a classic competing 
tension between the provision of immediate disaster assistance 
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and administrative perfection. As you move closer to one, you 
move farther away from the other." 12 

When we were engaged in fieldwork on another report in early 
2010, a senior Individual Assistance official told us that there 
were three ways to do things — "quick, right, and cheap" — and 
that FEMA could do only two at a time. 

In its report, the Senate Committee rejected the position that the 
government cannot both protect taxpayers and respond effectively 
to the urgent needs of disaster victims. We agree with the Senate 
Committee's assessment. 

Fraud Prevention Must Become Part of FEMA 9 s Mission 

FEMA's leaders must take visible, substantive, continual steps to 
demonstrate the importance of fiscal responsibility and program 
integrity. "Instilling a strong ethical culture and setting the 
correct tone at the top are essential elements in preventing 
fraud." 13 

FEMA's Chief Financial Officer (CFO) told us that "the test for 
success shouldn't be 'get the money out the door.'" He stated that 
the Administrator does not believe that mission focus and 
financial accountability are mutually exclusive, and asserted that 
senior leadership understand the importance of financial 
accountability. The challenge will be to communicate this 
message throughout FEMA, which will require a sustained, long- 
term effort. 

According to one official, a July 2009 memo from the FEMA 
Administrator to senior management emphasizing the need to 
improve internal controls had no tangible effect on disaster 
assistance programs, but did lead to placing FPIB under the 
Office of the Chief Security Officer. 

Senior officials advised us that another memorandum was being 
prepared for the Administrator's signature that would stress the 
importance of FEMA- wide antifraud efforts. This memo was 



Written statement of Michael Brown, then-Director, FEMA, for the U.S. Senate, Committee on 
Homeland Security and Government Affairs, hearing on FEMA 's Response to the 2004 Florida 
Hurricanes: A Disaster for Taxpayers?, May 18, 2005, pp. 5-6. (The title of the head of FEMA was 
changed from "Director" to "Administrator" in the Post-Katrina Emergency Management Reform Act of 
200tf,6U.S.C.§7Ol.) 

13 Institute of Internal Auditors, International Professional Practices Framework. 
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presented to us as an important piece of an effort to increase fraud 
prevention throughout the agency. However, the brief memo, 
issued on January 7, 201 1, fails to mention FPIB, FEMA's history 
of improper payments, or the susceptibility of FEMA's programs 
to fraud. The memorandum is attached as Appendix D. 

FEMA fraud prevention activities to date include: 

• A briefing for the Administrator on fraud prevention plans; 

• A briefing by the Administrator to regional directors about 
FPIB; 

• The reorganization of the Office of the Chief Security 
Officer, which now includes a Fraud & Internal 
Investigation Division; and 

• Weekly Administrator briefings by the Chief Security 
Officer, which include discussions of fraud issues. 

FY 201 1 FEMA fraud prevention plans include: 

• Meeting with division directors about the importance of 
combating fraud in their programs; 

• Meeting with National Processing Service Center (NPSC) 
leaders on increasing fraud prevention and deterrence 
activities; 

• Increasing the visibility of fraud prevention efforts; and 

• Carrying out an initiative to evaluate each FEMA program 
to enhance antifraud measures. 

Alignment of the Fraud Branch 

FPIB now reports to the OSCO; however, the Chief Security 
Officer does not report directly to the Administrator. Figure 7 
depicts the current FEMA organizational chart and FPIB's 
placement within the agency. Other federal agencies that provide 
direct benefits to individuals have established offices with the task 
of preventing fraud in their agency's programs that report directly 
to the program administrator. FEMA should follow their example. 

For example, the Department of Health and Human Services has 
established a Center for Program Integrity that reports directly to 
the office of the Administrator of the Centers for Medicare and 
Medicaid Services, and whose head is a deputy administrator and 
director. The Center for Program Integrity is the focal point for 
all Medicare and Medicaid program integrity, fraud and abuse 
issues, and performs the following functions: 
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• Identifies and monitors program vulnerabilities; 

• Recommends modifications to programs and works with 
program officials to affect changes; 

• Collaborates with the legislative office on the 
development and advancement of initiatives and 
improvements to deter, reduce, and eliminate waste, fraud, 
and abuse; 

• Oversees all interactions and collaboration with key 
stakeholders relating to program integrity for the purposes 
of detecting, deterring, monitoring, and combating fraud 
and abuse; and 

• In collaboration with others in the Department of Health 
and Human Services, develops and implements a strategic 
plan to carry out the program integrity mission and ensure 
that program vulnerabilities are identified and resolved. 

At the Department of Labor, an Internal Control Office, which 
reports directly to the Deputy CFO, performs annual assessments 
of internal controls for financial systems, and reports on improper 
payments. At the Small Business Administration, the Offices of 
Internal Control and Performance Management report to the CFO. 

The Social Security Administration Office of Quality 
Performance reports to the Office of the Administrator, and the 
Office of Quality Review within the Office of Quality 
Performance evaluates the quality of Social Security 
Administration operations with emphasis on preventing program 
and systems abuse, eliminating waste, and increasing efficiency. 

FEMA officials have been resistant to program changes because 
changes may interfere with their ability to promptly provide 
assistance to disaster survivors. Though we acknowledge their 
concerns, FEMA must do more to deter and prevent fraud and 
reduce the risk of improper payments. Realigning FPIB to report 
directly to the Office of the Administrator will demonstrate a 
renewed commitment to fraud prevention agency- wide. 
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Figure 7. FEMA Organizational Chart 
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Fraud Prevention Training Program Needed 



The Post-Katrina Emergency Management Reform Act of 2006 
states, "The Administrator shall develop and implement a 
program to provide training on the prevention of fraud, waste, and 
abuse of Federal disaster relief assistance relating to the response 
to or recovery from natural disasters and acts of terrorism or other 
man-made disasters and ways to identify such potential waste, 
fraud, and abuse." 14 Four years have passed, and FEMA has not 
planned or implemented a program to train employees on the 
prevention of fraud, waste, and abuse in disaster assistance 
programs. Only ad hoc training has occurred. 

The FPIB branch chief has provided fraud prevention training to 
some Individual Assistance personnel and External Affairs 
officials deployed in the field, as well as field office and law 
enforcement personnel, but this training has generally been 
limited to the Florida area (where FPIB is located). Additionally, 
NPSC employees are being taught how to identify fraud. The 
DHS OIG Office of Investigations is working with NPSC 
management to identify fake documents, such as leases that 
contain rental dates after occurrence of the applicable disaster. 
These lessons are then passed on to employees who work directly 
with applicants. Supervisors are alerted when an employee has 
made an improper payment so the employee can be counseled, 
avoiding a repeat of the mistake. The Office of the Chief Security 
Officer is considering putting fraud prevention training online, 
making it available to all FEMA employees. 

Conclusion 

FEMA needs to better balance mission focus and fiscal 
responsibility. Agency employees' duty to provide prompt 
assistance to disaster survivors should include a duty to pay 
eligible individuals in the proper amounts. Instilling fraud 
prevention awareness through an organizational change that 
elevates the authority of the Fraud Prevention and Investigation 
Branch and mandating annual fraud prevention training for all 
employees should result in fewer instances of improper disaster 
assistance payments. 



6U.S.C. §797. 
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Recommendations 



We recommend that the Administrator, Federal Emergency 
Management Agency: 

Recommendation #4 : Realign the Fraud Prevention and 
Investigation Branch to report directly to the Office of the 
Administrator. 

Recommendation #5 : Require annual fraud prevention training 
for all employees commencing with fiscal year 201 1. 

Management Comments and OIG Analysis 

FEMA does not concur with Recommendation #4. The agency 
does not believe that realigning FPIB will increase its visibility or 
operational efficiency. We recommended this realignment 
because: 

• A fraud prevention office reporting directly to the 
Administrator would symbolize the importance FEMA 
places on fraud prevention efforts; 

• FEMA managers not directly involved with FPIB were 
unaware of its existence or responsibilities; 

• FPIB is located outside any FEMA facility; 

• Offices of security in the government generally focus on 
personnel badging and facility and IT security matters 
rather than program integrity; and 

• Other federal benefit agencies have internal control and 
program integrity offices reporting directly to agency 
leaders. 

Throughout this report, we have recommended other actions that 
officials should take in order to make agency- wide fraud 
prevention efforts more visible, meaningful, and effective. FEMA 
has concurred with these recommendations. Specifically, FEMA 
has agreed to: (1) increase the staff and budget of FPIB; (2) train 
employees annually to identify and prevent fraud; (3) issue a 
FEMA management directive establishing the authority of FPIB; 
(4) acquire the latest technological tools to assist FPIB in 
preventing, detecting, and deterring fraud; and (5) continue to 
improve internal controls. (Additionally, the Office of the Chief 
Security Office, to which FPIB reports, is now led by a Senior 
Executive Service official.) When these actions have begun to be 
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implemented, we will reassess the need to realign FPIB. Until such 
reassessment, this recommendation is unresolved and open. 

FEMA concurs with Recommendation #5, but provided no 
timetable for completion. This recommendation is unresolved 
and open until a fraud awareness training course is created and all 
FEMA employees are mandated to take such course annually. 



Developing and Maintaining Internal Controls 

FEMA needs to further develop and maintain proper internal management 
controls to prevent and detect fraud, waste, and abuse. Prior OIG and 
GAO reviews have shown that FEMA has made some improvements in 
internal controls but that challenges remain. 

Prior Reviews of FEMA Internal Controls 

In June 2009, GAO reported that FEMA had significantly 
improved its fraud prevention controls regarding disaster 
assistance. For example, FEMA conducted identity and address 
verification on all applications and required inspections before 
approving rental assistance for hurricanes Ike and Gustav. FEMA 
also had taken steps to flag and cancel duplicate registrations for 
the same disaster. However, GAO identified flaws in FEMA's 
controls by submitting fabricated documents to prove identity or 
address, and as a result, obtained housing assistance. GAO also 
received duplicate payments for bogus hotel expenses. FEMA 
failed to properly inspect a false address GAO used to apply for 
assistance, and as a result, GAO received multiple checks for 
thousands of dollars in rental assistance. FEMA officials 
commented that they would establish random checks to assess the 
validity of supporting documentation submitted by applicants to 
verify identity and address. 15 

In September 2009, we reported that FEMA showed substantial 
improvements in internal controls, resulting in fewer instances of 
payments made to registrations with duplicate and invalid key 
data. However, FEMA was not fully using its validity checks for 
key registration data, and payments were made to thousands of 
registrants who failed key checks for identity, occupancy, or 



15 FEMA Strengthened Its Fraud Prevention Controls, but Customer Service Needs Improvement (GAO-09-671), 
June 2009. 
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ownership. FEMA officials indicated that corrective actions 
would be initiated to resolve the recommendations. 16 

Suggestions to Enhance Internal Controls and Combat Fraud 

The FEMA Administrator is required to develop and maintain 
proper internal management controls to prevent and detect fraud, 
waste, and abuse in disaster assistance relief programs. 17 



Improper Payment Case Study 

Jane Doe applied for assistance after Hurricane Katrina. 
A FEMA caseworker noticed a link between Doe and 
other applicants, who listed Doe as the owner or property 
manager of their rented properties. An FPIB review 
determined that Doe and 12 cohorts, in applying for 
assistance after hurricanes in Florida and Louisiana, a 
tornado in Kansas, and a fire in California, provided 
nonexistent addresses, falsely claimed to have lived at 
certain addresses, supported residency at these addresses 
with fake documents, and directed assistance to go to 
bank accounts controlled by Doe. These schemes netted 
more than $130,000 in assistance. 

suggested: ^^^^^^^^^^^^^^^^^^^^^^^^^^^ m 

• Expanding the capability of NEMIS to identify duplicate 
registrations to include slight variations in disaster 
addresses; 

• Requiring follow-up with applicants who claimed to have 
insurance to ensure that they reimburse FEMA after their 
insurance settlement; 

• Adding a red fraud warning banner to the top of FEMA' s 
disaster assistance registration website to alert applicants 
that committing fraud is a federal offense; 

• Having NEMIS send an alert to FPIB when certain fraud 
indicators are encountered; and 

• Including a telephone "hold" fraud warning message when 
applicants seeking assistance are on hold. 

After incidents of employee fraud and applicant fraud were 
brought to the attention of senior management, FEMA established 
an internal Fraud Task Force to make recommendations to protect 
FEMA from similar incidents in the future. Its 2010 



Various FEMA 
groups with 
responsibility to 
lessen instances of 
fraud, waste, and 
abuse in the IHP 
have made 
recommendations 
to further enhance 
internal controls. 
For example, FPIB 
officials have 



Improvements to Internal Controls for FEMA 's Individuals and Households Program Registration Process (OIG- 
09-110), September 2009. 
17 6U.S.C. §795(a)(l). 
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recommendations were forwarded to the Response and Recovery 
Directorate and include the following: 

• In coordination with FPIB, begin development of 
analytical reports on activity that is suspicious, using 
NEMISdata; 

• Increase fraud briefings for all employees who have access 
to personally identifiable information; and 

• Include fraud awareness scenarios in the existing Internal 
Control Awareness training module. 

The Office of the CFO, in partnership with DHS' Office of 
Management, conducted an annual assessment on IHP payments 
in compliance with the Improper Payments Information Act of 
2002 (IPIA). 18 A sample of FY 2009 IHP payments was tested, 
resulting in an estimate of improper payments of $22.9 million or 
an error rate of 2.72%. Identified improper payments included the 
following: 

• Duplication of benefits - a second inspection review 
resulted in a caseworker paying for the same line item 
twice; 

• Overlapping assistance - applicants received improper 
payments resulting from payments that fully or partially 
overlapped with other payment types; 

• Ineligible applicant - applicant did not meet all eligibility 
qualifications; 

• Case processing errors - applicants received payments 
where they did not supply necessary documentation (e.g., 
receipts) or owing to inaccurate analysis of the case; and 

• Calculation errors - applicants received improper 
payments resulting from incorrect calculations or 
applications of the fair market value formula. 

The FY 2010 IPIA assessment made the following 
recommendations to address these errors: 

• FEMA should work to improve caseworker guidance for 
types of payments identified as being at a higher risk for 
improper payments; 

• FEMA should perform follow-up internal audits of 
manually approved home repair assistance; and 



18 P.L. No. 107-300, 116 Stat. 2350 (November 26, 2002), as amended by the Improper Payments 
Elimination and Recovery Act of 2010, P.L. No. 1 1 1-204, 124 Stat. 2224 (July 22, 2010). 
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• FEMA should develop better tools to ensure accurate 
processing of awards generated by multiple inspections. 

The 2010 assessment also noted that some recommendations from 
the FY 2009 IPIA assessment were not implemented. 

Additionally, our Forensics Division recently performed a limited 
review of NEMIS eligibility and insurance data from hurricanes 
Gustav and Ike for evidence of assistance paid to individuals who 
indicated they had homeowners insurance during the registration 
process. FEMA approved more than $23 million in non- flood- 
related IHP assistance that exceeded the likely insurance 
deductible to about 6,400 registrants who claimed they had 
insurance and whose homes suffered damage caused by 
something other than flooding. As FEMA does not track whether 
these registrants ultimately received a settlement from their 
insurance company, it is likely that some or all of them received 
assistance from FEMA and an insurance settlement for the same 
damages. 

Even if a recommendation to enhance internal controls is 
approved for implementation, changes to NEMIS typically take 
up to 2 years; however, a high-priority change can be made in 
6 months. Normally, FEMA officials told us it can take 6 months 
to finalize change requirements; the change request is then put in 
a queue with other recommendations, subject to funding limits 
and higher-priority changes. Then, system testing takes an 
additional 6 months. During this 2-year period, a "workaround" 
is established to immediately curtail the automatic process that is 
allowing improper payments. 

FEMA Internal Control Board 

In a July 2009 memorandum, the FEMA Administrator established 
the FEMA Internal Control Board, co-chaired by the Deputy 
Administrator and the CFO, to assess and govern internal controls 
across FEMA, and to identify and implement improvements on a 
continuous basis. 

In the memorandum, the Administrator expressed dissatisfaction 
with the state of FEMA' s internal controls. He indicated that he 
is committed to establishing a necessary level of financial 
stewardship and program accountability within FEMA. However, 
the Internal Control Board has not assessed and governed internal 
controls across FEMA. Instead, in the three meetings held to 
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date, its focus has been on grants, and the intent is to focus on 
specific rather than enterprise-wide issues. 

Conclusion 

Although FEMA has made some improvements to internal 
controls, more needs to be done. We, as well as GAO and FEMA 
itself, continue to identify needed improvements in internal 
controls. Various FEMA groups have suggested ways to combat 
fraud and enhance internal controls. FEMA needs to strengthen 
internal controls in its IHP program to ensure that only eligible 
applicants receive assistance. FEMA is at high risk for issuing 
improper payments if internal controls are not strengthened and 
corrective actions are not implemented in a timely manner. 

Recommendations 

We recommend that the Administrator, Federal Emergency 
Management Agency: 

Recommendation #6 : Develop, implement, and maintain proper 
internal management controls to prevent and detect fraud, waste, 
and abuse in disaster assistance relief programs as required by 
statute. 

Recommendation #7 : Require the Internal Control Board to 
assess and govern internal controls across the Federal Emergency 
Management Agency, including all Individual Assistance, Public 
Assistance, and Mitigation Programs, and to identify and 
implement improvements on a quarterly basis. 

Management Comments and OIG Analysis 

FEMA concurs with Recommendation #6, but its response does 
not make clear that it understands that additional internal controls 
are needed. In its response to Recommendation #7, FEMA cites a 
GAO report that "FEMA has significantly improved its fraud 
prevention controls over disaster assistance." However, that same 
report notes that fraudsters can bypass FEMA's controls using 
fabricated documents, and FEMA has begun recouping improper 
assistance payments made only months ago in connection with a 
2010 flood event in Chicago. Thus, it is clear that more can be 
done to improve internal controls. FEMA also states that 
assistance is based on verifiable documentation provided by the 
applicant. But FEMA does not verify the documentation by 
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calling landlords, checking banking records, reviewing property 
records, or the like. FEMA also resists adding inexpensive controls 
such as a fraud prevention banner on the webpage containing its 
online application for financial assistance and an anti-fraud 
message applicants applying by telephone would hear. This 
recommendation is unresolved and open. 

FEMA concurs with Recommendation #7, but the response does 
not clearly state that the Internal Control Board will assess 
internal controls across the agency or ensure that improvements 
are implemented quarterly, where possible. This recommendation 
is unresolved and open. 

Improper Payment Recoupment Process 

From June 2007 through January 201 1, FEMA had not attempted to recoup 
improper disaster assistance payments, and past and current Administrators 
have been hesitant to restart the recoupment process. As a result, 
$643 million in potentially improper payments disbursed since Hurricane 
Katrina had gone uncollected for several years. 

FEMA Debt Goes Uncollected for Years 

Executive agencies are required by law to collect debts of the U.S. 
government. 19 If a nontax debt owed to the United States is 
delinquent for a period of 180 days, the head of the agency that 
administers the program that gave rise to the debt transfers the 
debt to the Secretary of the Treasury for collection. 20 

As of October 2006, FEMA reported it had disbursed 
approximately $7 billion in IHP disaster assistance payments 
related to hurricanes Katrina and Rita. 21 Figure 8 illustrates 
assistance being provided to applicants as a result of Hurricane 
Ike. 



19 31U.S.C. §3711(a)(l). 

20 
21 



31 U.S.C. §371 1(g)(1)(A). 

Hurricanes Katrina and Rita Disaster Relief: Prevention Is the Key to Minimizing Fraud, Waste, and 



Abuse in Recovery Efforts (GAO-07-418T), January 2007. 
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Figure 8. Hurricane Ike Disaster Recovery Center 




Source: FEMA Photo Library; photographer, Greg Henshall. 



According to FEMA records, more than $621.6 million of 
potentially improper IHP disaster assistance payments have been 
identified in response to hurricanes Katrina and Rita, and an 
additional $21.7 million of potentially improper IHP payments 
have been identified in response to subsequent disasters. 

FEMA officials involved in the recoupment process believe the 
main reasons for the potentially improper payments were 
(1) overpayment for damages, (2) payments made despite 
unproven residency or payments made for secondary residences, 

(3) inadequate identification verification of the recipient, and 

(4) expedited payments ($2,000 each) sent to ineligible parties. 
Prior to 2008, FEMA had a recoupment process to collect 
improper payments, but it was complex and difficult to apply 
consistently. 

Recoupment Stopped 

In 2007, as a result of a lawsuit challenging, among other things, 
FEMA's process for recouping improper disaster assistance 
payments made in the aftermath of hurricanes Katrina and Rita, 22 a 
federal district court judge issued an injunction ordering FEMA to 
discontinue its debt collection activities until certain changes were 
made in its recoupment process. FEMA was prohibited from 
terminating or discontinuing Section 408 assistance without — 



Ridgely v. FEMA, 2007 U.S. Dist. LEXIS 43002 (E.D. La. June 13, 2007). 
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• Prior written notice of the reasons for the termination or 
discontinuance; 

• An opportunity for an appeal hearing; 

• A written decision on the appeal; and 

• Adequate written notice of the basis for any demand for 
repayment of disaster relief assistance. 

This court order, along with regulations established by DHS in 
2007, led FEMA to suspend the recoupment process. FEMA 
suspended the process in a September 2008 Federal Register 
notice, where it announced that it was terminating its recoupment 
of all Section 408 assistance payments made to Katrina and Rita 
applicants, and that previous notices sent to applicants were 
withdrawn. 23 This announcement did not cancel the valid debts; 
it terminated the procedure under which the debts were recouped. 
FEMA also announced that it would reexamine the files of every 
applicant, and where such review determined that recoupment 
was still warranted, a new recoupment proceeding and a new 
notice of debt would be initiated. Based on this announcement, 
the court dissolved the preliminary injunction as it related to 
recoupment. 

New Recoupment Process Drafted 

FEMA's Office of Chief Counsel, in cooperation with the 
Individual Assistance Office and the FEMA Finance Center, 
developed a new recoupment process which, in the Counsel's 
opinion, meets the district court's concerns and complies with 
DHS' debt collection standard. (Figure 9 is a flowchart of the 
new recoupment process.) The new process had existed in draft 
form and awaited approval by the Administrator since late 2008. 

The Training, Applicant Support, and Communication unit at the 
Texas National Processing Service Center (TXNPSC) is 
responsible for carrying out the new recoupment process. As 
agreed, a de novo review of the approximately 167,000 cases began 
in November 2010. A review strategy is in place; cases in which 
the debt was already paid in full, the debtor has since died, or 
applicants returned or never received checks will be dealt with first. 
If a reviewer agrees with the original decision to recoup and agrees 
with the recoupment amount, the recoupment process may begin. 



FEMA stopped attempting to recoup all improper payments that resulted from hurricanes Katrina and 
Rita and subsequent disasters until the new recoupment process was approved. 
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New Process Awaits Approval 



Discussions about restarting the process were held with a previous 
Administrator and administration. More recently, presentations 
regarding the debt were made to the current Administrator and 
administration. 

FEMA officials are concerned about collecting this debt. 
Memories of FEMA' s inadequate response to hurricanes Katrina 
and Rita will be revived, and people struggling in a sluggish 
economy will be asked to return money they spent years ago. 
Suggestions to "forgive" the debts resulting from hurricanes 
Katrina and Rita, or to establish a threshold below which the debt 
would be forgiven, were made in the past. However, OMB has 
advised FEMA that it has no authority to forgive debts. 

TXNPSC personnel are ready to proceed. Fourteen staffers are 
assigned to the recoupment process, and when a go-ahead is 
received, the other available employees of TXNPSC will be asked 
to assist. FEMA intends to collect the more recent debt first, then 
pursue debts of $10,000 and more related to hurricanes Katrina 
and Rita, and last collect Katrina and Rita debt less than $10,000. 

Challenges will arise once the process begins. Some debtors 
provided false names, and some addresses will no longer be valid, 
or debtors may be able to provide documentation to resolve their 
debts. TXNPSC staff must be alert to fake documents that may 
be presented to prove eligibility for assistance. The staff is 
working with OIG's Office of Investigations on this issue and will 
validate submitted documentation. 

The FEMA Finance Center's antiquated IT systems continue to 
slow productivity. Currently, TXNPSC has 100,000 cases with 
no payment information because the IT system the FEMA 
Finance Center uses to track recoupment cases does not integrate 
with the data system used by TXNPSC. 24 Updated IT systems for 
the FEMA Finance Center have been requested, but necessary 
funding has not been provided. 



6 U.S.C. §795(a)(4) says that, "The Administrator shall ensure that the databases used to collect 
information from applications for such assistance must be integrated with disbursement and payment 
records." 
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figure 9. FEMA's New Recoupment Process Flowchart 



NPSC sends Notice of Debt Letter (NOD) stating: Applicant has a debt of $ to repay; 

nature and amount of debt in detail; App has 60 days to appeal in writing (with instructions 
how to do so); encloses "Debt Repayment Process: In a Nutshell" document. 
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OIG Management Advisory Published 



After determining the size of the uncollected debt, the delay in 
attempting to recoup it, and FEMA's legal obligation to collect it, 
OIG issued a three-page management advisory report directed to 
the FEMA Administrator, Recoupment of Improper Disaster 
Assistance Payments (OIG- 1 1-21), on December 10, 2010. The 
report recommended that the FEMA Administrator promptly take 
action to initiate the recoupment process. 

In December, a knowledgeable FEMA official told us the current 
plan was to restart the process in February 201 1; in January 201 1, 
a FEMA spokeswoman, in response to the management advisory 
report, reportedly told CNN that FEMA did not yet have a date 
for restarting the recoupment process. 

Recent Activity 

At a congressional hearing on March 17, 201 1, 1 day after a draft 
of this report was transmitted to FEMA for comment, a FEMA 
official testified that the agency had published a notice in the 
Federal Register announcing the restart of the agency's 
recoupment process, and mailings of Notices of Debt had begun, 
starting with the most recent debt first. 

Conclusion 

FEMA has a legal obligation to collect debts resulting from 
improper disaster assistance payments. The Administrator should 
ensure that the recoupment process continues until all cases are 
resolved through collection, suspension, termination, or transfer 
of debt to the Department of the Treasury. 

Recommendation 

We recommend that the Administrator, Federal Emergency 
Management Agency: 

Recommendation #8 : Ensure that the process to recoup 

$643 million in potentially improper Individuals and Households 

Program payments continues until all cases are resolved. 
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Management Comments and OIG Analysis 



In the draft report, Recommendation #8 called on the 
Administrator to order the recoupment of improper payments that 
had been on hold for several years. In its response, FEMA 
concurred with this recommendation and asked that it be closed 
because the Administrator had ordered the recoupment in the 
interim. However, we have revised the recommendation in this 
final report to ensure that FEMA pursues collection of the 
improper payments. This recommendation is resolved and open. 
We will seek periodic progress reports on the status of the 
recoupment process and will close this recommendation when 
FEMA has made significant progress toward resolving the 
approximately 167,000 cases. 
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Appendix A 

Purpose, Scope, and Methodology 

We performed an inspection of FEMA's Fraud Prevention and 
Investigation Branch. The objectives of the inspection were to 
determine the effectiveness of the Fraud Branch by assessing 
whether this organization has (1) achieved the desired outcomes of 
identifying and reporting to Inspector General officials potentially 
fraudulent disaster payments; (2) worked across FEMA to develop, 
maintain, and enhance proper internal management controls to 
prevent fraud, waste, and abuse; and (3) prevented fraudulent 
losses of federal funds through agency awareness, comprehensive 
research, coordination, and internal investigation. 

We interviewed FEMA headquarters officials; the chief of the 
Fraud Branch; employees of the Winchester, VA, and Denton, TX, 
National Processing Service Centers, and the FEMA Finance 
Center; and a FEMA employee with experience as a disaster 
assistance agent. Our fieldwork was conducted in the District of 
Columbia, Florida, and Virginia. 

We reviewed federal laws, regulations, executive guidance, 
published reports, and other information related to FEMA's Fraud 
Prevention and Investigation Branch. 

We conducted our review between September 2010 and January 
201 1 pursuant to the Inspector General Act of 1978, as amended, 
and according to the Quality Standards for Inspections issued by 
the Council of the Inspectors General on Integrity and Efficiency. 
Major OIG contributors to the review are identified in Appendix E. 

FEMA's technical comments have been incorporated, as 
appropriate. 
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Appendix B 

Management Comments to the Draft Report 



U.S. Department of Homeland Security 

Washington, DC 20472 

M FEMA 



. APR 1 8 2011 

MEMORANDUM FOR: Charles K. Edwards 

Acting Inspector General 
Department of Homeland Security 

FROM: /jf David J. Kaufman V " ; : ^jP 

/ - Director, Office of Policy and Program Analysis 

SUBJECT: FEMA Response to OIG Draft Report: Assessment of FEMA 's Fraud 

Prevention Efforts 

OfG Project No. 10-146-EMO-FEMA 

Thank you for the opportunity to review and comment on the Office of Inspector General's (OIG's) 
subject draft audit report. As the Federal Emergency Management Agency (FEMA) works toward 
refining its programs, the OIG's independent analysis of program performance greatly benefits our 
ability to continuously improve our activities. FEMA has reviewed this report and concurs with 
recommendations 1,2,3,5,6,8, and 9, and non-concurs with recommendations 4 and 7. In addition, 
we are requesting closure for recommendation 9 as the recoupment of improper disaster assistance 
payments has already started, 

FEMA has one overarching concern with the subject report. OIG maintains a close, direct working 
relationship with FEMA's Fraud Prevention and Investigation Branch (FP&IB). FP&IB staff 
members often function as an extension of OIG's investigative workforce, enabling OIG to reduce 
its own investigative workload. FEMA is concerned that the close, direct working relationship may 
have affected the analytical objectivity of the subject report, specifically with respect to 
Recommendation 4. OIG recommends that FP&IB be elevated to a higher profile within the 
Agency, while not articulating a probable direct linkage between the desired substantive impact and 
the recommended action. FEMA contends that the desired substantive impact, specifically 
demonstration of "renewed commitment to fraud-prevention agency-wide," is not solely achievable 
through the recommended structural change, as other mechanisms can be used to elevate its profile. 

FEM A's response to each of the report's nine recommendations follows: 

Recommendation 1 : Reallocate resources to increase the staff and budget of the Fraud Prevention 
and Investigation Branch. 

FEMA response : FEMA concurs with the recommendation. FEMA has conducted a review of its 
FP&IB staffing levels, and, as a result of this review, FEMA plans to increase FP&IB Cadre of On- 
Call Reserve Employee (CORE) staffing levels by 50 percent in FY11, and another 50 percent in 
FY12. This increase will significantly enhance FEMA's investigative operations, analysis of 
disaster fraud, and further agency-wide fraud awareness training initiatives. 

www, fcma.gov 
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Recommendation 2 : Issue a Federal Emergency Management Agency Directive that establishes the . 
Fraud Prevention and Investigation Branch as the agency-wide office with the authority to 
investigate all claims of potential fraud, waste, and abuse, proactively review disaster assistance 
payments, and recommend improvements to internal controls. 

FEMA response ; FEMA concurs with the recommendation. The Office of the Chief Security 
Officer will draft, coordinate, and issue an agency-wide directive on FP&IB and its responsibilities 
to investigate all claims of potential fraud, waste and abuse, proactively review disaster assistance 
payments, and recommend improvements to internal controls. 

Recommendation 3 : Adopt similar cutting-edge technology used by the Recovery Accountability 
and Transparency (RAT) Board, 

FEMA response : Concur, but before FEMA can issue a final position on this recommendation, a 
more detailed review of the specific technologies used by the Recovery Accountability and 
Transparency Board will need to be conducted. As such, FEMA has scheduled a meeting with the 
RAT Board to review and evaluate the software tools, government databases, and open-source 
information systems they employ to ensure proper accountability and transparency in the 
expenditure of Government funds. If it appears that the capabilities offered by these cutting-edge 
technologies (or variations thereto) will help FEMA better identify and/or prevent the disbursement 
of improper and/or fraudulent disaster assistance payments, FEMA will explore those opportunities. 
However, please note that FEMA has already deployed a new IT system for the FB&IB that is 
designed to: 

• Integrate with agency IT systems and, using internal and external data, develop filters and 
algorithms for data mining of disaster claims to search for and detect anomalies. 

• Provide a risk-mapping tool to help identify risk and document appropriate risk-interdiction 
strategies. 

• Serve as a case management system for collecting and tracking investigative activities and 
analysis involving disaster fraud. 

• Provide FEMA with a consistent, repeatable, auditable, defensible system of records to 
support FEMA's response to disaster fraud. 

• Be portable, integrative, and expandable. 

• Provide FEMA with the flexibility and tools to address current FEMA disaster fraud 
investigations and anticipated disaster fraud schemes. 

Recommendation 4 : Realign the Fraud Prevention and Investigation Branch to report directly to 
the Office of the Administrator. 

FEMA response : FEMA non-concurs with the recommendation. While FEMA certainly shares the 
OIG's appreciation for the important role exercised by the FP&IB, that role is no more or less 
critical than any other of numerous key functional activities assigned to units within our Agency. 
FEMA contends that the desired substantive impact, specifically demonstration of "renewed 
commitment to fraud-prevention agency-wide," is not solely achievable through the recommended 
structural change. FEMA feels the FP&IB is properly situated within the Office of the Chief Security 
Officer (the principal of which was recently upgraded to a Senior Executive Service position) and 
changing its location would in no way improve its operational efficacy. 
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Recommendation 5 : Require annual fraud prevention training for all employees commencing with 
fiscal year (FY) 2011. 

FEMA response : FEMA concurs with the recommendation. The Office of the Chief Security 
Officer will collaborate with FEMA's Emergency Management Institute to implement an agency- 
wide web based employee-training program on Fraud Prevention Awareness. 

Recommendation 6: Develop, implement, and maintain proper internal management controls to 
prevent and detect fraud, waste and abuse in disaster assistance relief programs as required by 
statute. 

FEMA response : FEMA concurs with this recommendation. We have established proper internal 
management controls and use a variety of tools to prevent fraud, waste and abuse during our routine 
business practices. These controls include: 

• All applicants will go through our identity verification process and are restricted from 
receiving assistance until they verify their identity. 

• All rental, repair, replacement and personal property assistance is currently based on an on- 
site verification, by a field inspector, of all claimed losses. 

• All other types of assistance are based on verifiable documentation provided by the applicant, 
and scanned and stored in National Emergency Management Information System (NEMIS). 

• The National Processing Service Center (NPSC) Operations Audit Section assesses random 
samples of cases throughout the year to identify and recommend process improvements to 
further limit waste. 

• The Enterprise Coordination and Information Management (ECIM) Section maintains the 
ability to mine data and provide reports on potentially improper payments, and provides 
exception ( "Cleanup" ) reports to the National Coordination Team on a regular basis. 

• The Appeals/Recoupment Department in the Training, Applicant Support and 
Communications Section was established in 2010 to process claims for additional assistance 
in a consistent and controlled process. Those assigned to Recoupment are responsible for 
identifying recoupment cases and beginning collection of improper payments. 

• The Individual and Households Program (IHP) Assistance Group was established in 2008 to 
provide an internal helpline for our casework staff who may have questions regarding IHP 
case processing procedures, thereby driving increased consistency on even more complicated 
casework. 

• In 201 0, our caseworker guidance was collected into the Processing Procedures Manual 
(PPM). The PPM is a website organized to provide guidance and job aids to caseworkers for 
all standard cases. The PPM is extensively version-controlled and managed in order to ensure 
that the latest guidance is always available. 

• Our Housing Inspection Services Contract Management Section has achieved ISO 
(International Organization for Standards) 9001-2000 certification for their quality 
management system and the National Coordination Team is in the process of receiving such 
certification. These certifications indicate that the NPSC enterprise is committed to ensuring 
that our quality systems are designed to prevent waste, fraud and abuse in delivery of IHP 
assistance. 
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Recommendation 7 : Require implementation of internal control improvements to the National 
Emergency Management Information System on a quarterly basis to prevent potential fraud, waste, 
abuse, and improper payments. 

FEMA response : FEMA non-concurs with this recommendation. A quarterly schedule for 
implementation improvements to the National Emergency Management Information System 
(NEMIS) is not appropriate. Extensive experience with developing additional controls within 
NEMIS had led to the development of a bi-annual schedule for major releases as the most efficient 
and least disruptive deployment approach. The reasons for this approach are as follows: 

Time and overhead associated with NEMIS releases 

NEMIS is a complicated set of databases and applications. Each NEMIS release is a costly endeavor 
involving coordination across numerous Directorates and Divisions within the Agency. This includes 
Public Assistance, Mitigation, OCFO, and OCIO in addition to NPSC staff. Even partial NEMIS 
changes that involve delivery of IHP assistance require module testing from other groups such as 
Public Assistance or Mitigation to ensure their systems are not affected by changes in the Individual 
Assistance module. Other offices or Divisions within the Agency do not have dedicated full time 
staff to test the system, and must rely on staff diverted from other projects. Moreover, many changes 
within IHP to control fraud or waste are highly complicated, particularly when changes deal with our 
automation business rules. It is not feasible or cost effective to develop, test and deploy many 
business rules or other processing changes more often than twice a year. 

Disruption of disaster processing activities 

Due to the complexity of NEMIS, each release usually requires significant downtime (at least a 
weekend) during which all disaster processing activity ceases. In order to minimize disruptions, 
FEMA attempts to schedule releases in December or January, and June, in order to avoid our peak 
activity periods. Historically, August through mid November (hurricanes) and February through 
May (flooding and tornadoes) are high activity periods. Quarterly releases would naturally occur 
during those active times. Bi-annual releases allow us to avoid those peak periods, ensuring disaster 
survivors are served as quickly as possible. 

NEMIS provides a great deal of flexibility in preventing fraud without implementin g up grades 
Although we agree that FEMA should act as quickly as possible to remedy weaknesses that 
potentially expose IHP assistance to fraud, waste and abuse, NEMIS already offers a number of tools 
. that make it flexible, even without a major release. In the NEMIS administrative module, we have 
the ability to implement 'special handling' queries, which remove cases that meet certain criteria 
from our automated business rule processing. For instance, if we were to find an error in a business 
rule, we can readily implement special handling to ensure that a caseworker reviews the case to fix it 
manually. This can be done within hours of identifying a potential issue. This special handling 
capability can also be used to flag cases that present a special risk for fraud, waste or abuse. 

NEMIS also allows us to add "data markings" to applicants meeting a certain criteria. For example, 
if we learned that a group of applicants were being assisted by another agency, we can quickly add a 
data marker to them, and subsequently use the marker to prevent potentially duplicative assistance. 
Additionally, we have the ability to implement emergency fixes to implement new programs or 
provide critical updates outside of the typical six month schedule, particularly when such changes do 
not alter existing rules and processes. For instance, during Hurricanes Gustav and Ike, we deployed a 
technical solution to implement the new Transitional Sheltering Assistance program in a matter of 
weeks. The technical solution included (1) business rule logic to determine program eligibility, (2) 
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procedures for adding information to NEMIS for caseworkers to view, (3) procedures to export data 
to our vendor, (4) import procedures for data returning from the vendor, and (5) changes to our 
Interactive Voice Response (IVR) system to help applicants through our self service module. 
Because these processes were largely done outside of the existing NEMIS architecture, we were able 
to deploy the changes rapidly and without the disruptions noted above. 

Based on the above factors, we believe the implementation of quarterly releases would be 
unnecessarily disruptive and would add costs without significantly improving our already 
strengthened position to prevent waste, fraud and abuse. Since Hurricanes Katrina and Rita, we have 
implemented a significant number of controls, as noted by GAO in Final Report 09-671 on Fraud 
Prevention Efforts in Hurricanes Gustav and Ike, in which GAO stated that l FEMA has significantly 
improved its fraud prevention controls over disaster assistance. ' 

Recommendation 8; Require the Internal Control Board to assess and govern internal controls 
across FEMA, including all Individual Assistance, Public Assistance, and Mitigation Programs, and 
to identify and implement improvements on a quarterly basis. 

FEMA response : FEMA concurs with the recommendation. The Internal Control Board (ICB) co- 
chaired by the Deputy Administrator and the CFO is scheduled to meet quarterly in FY 201 1 . The 
ICB has focused on Grant Management. Additionally, the ICB has discussed and been provided 
updates on the Improper Payment Information Act (IPIA) requirements which test improper 
payments. The IPIA testing is beginning to move towards quarterly testing of several of its 
programs and will eventually test all payments quarterly. The ICB has also been updated on CFO 
efforts to establish a consistent Internal Control process that supports the Agency's Assurance 
Statement memorandum. 

Recommendation 9 : Order the recoupment of improper disaster assistance payments to begin no 
later than April 1,2011. 

FEMA response : FEMA concurs with the recommendation and requests that it be closed. FEMA 
has started its new recoupment process. On March 15, 201 1 FEMA published the intent to proceed 
with recoupments in the Federal Register at http://edocket.access.gpo.gov/201 1/201 1 -6036.htm. On 
March 16, 201 1, FEMA commenced recoupment by sending out notices of debt letters (NODs), 
starting with the most recent debt first. 
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FEMA Fraud Prevention and Investigation Branch (FPIB) 

Case Flowchart 
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Source: DHS-OIG analysis of FEMA provided data. 
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U.S. Department at Homeland Security 

Washington. DC 20523 




FEMA 



SUBJECT: FEMA's Efforts to Combat Disaster Fraud 



On July 22, 201 0* President Obama signed into law the Improper Payment Elimination and 
Recovery Act, which is aimed at intensifying efforts to eliminate payment error, waste, fraud, and 
abuse in major programs administered by the Federal Government by $50 billion between now and 
2012, The Federal Emergency Management Agency (FEMA) provides disaster relief to families and 
communities to rebuild from a disaster; however, it must be limited to those who have truly suffered 
losses. Fraudulent claims take taxpayer money away from those truly in need of assistance and 
weaken the Federal Government's ability to provide support 

As an Agency, we are making progress in detecting and preventing disaster fraud through our fraud 
prevention training and strengthening of our program controls. However, we still have more work to 
do. It is the responsibility of every member of the FEMA team to be vigilant in preventing and 
reporting improper payments and other forms of waste, fraud, and abuse. Our good stewardship of 
taxpayer dollars will ensure that we can be fully responsive to the needs of the American people 
before, during, and after a disaster. 

Information on additional fraud prevention training will be forthcoming. 

For additional information or to report fraud, waste, or abuse, email stop femafraud (fodhs , go v or call 
FEMA's Fraud Hotline number at 1.866.223.0814. 
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Polin Cohanne, Senior Program Analyst 
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Office of Management and Budget 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



